Description
Multiple vulnerabilities exist in Barracuda Networks products due to improper validation of user-controlled input. User-controllable input supplied to the embedded web server is not properly sanitized for illegal path delimiting characters prior to being used to access files. A specially crafted HTTP request containing directory traversal sequences could allow remote attackers to conduct traversal attacks.
Remediation
The vendor has released Security Definition update v2.0.4 that addresses these vulnerabilities.
References
Related Vulnerabilities
WordPress Plugin RB Agency Local File Disclosure (2.4.7)
Drupal Core 9.0.x Directory Traversal (9.0.0 - 9.0.14)
WordPress Plugin Fusion Engage Local File Disclosure (1.0.5)
WordPress Plugin Media from FTP Directory Traversal (9.85)
WordPress Plugin CIP4 Folder Download Widget Local File Inclusion (1.10)